Vulnerability-Lookup

BDU:2026-16694 (CVE-2026-74408)

Vulnerability from fstec – Published: 2026-10-16 – Updated: 2026-10-16 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции ath_tx_edma_tasklet() компонента drivers/net/wireless/ath/ath9k/xmit.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции ath_tx_edma_tasklet() компонента drivers/net/wireless/ath/ath9k/xmit.c ядра операционной системы Linux связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

8.3 (High) CVSS 2.0


                      
                        AV:A/AC:L/Au:N/C:C/I:C/A:C

8.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-787 - Запись за границами буфера

Aliases

CVE-2026-74408, GHSA-6HV7-5H9P-9JRW

References

16 references

URL
https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0
https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc
https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc
https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25
https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0
https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379
https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481
https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54
https://github.com/advisories/GHSA-6hv7-5h9p-9jrw
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/aarch64/updates/
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
https://security-tracker.debian.org/tracker/CVE-2026-74408
https://deb.freexian.com/extended-lts/tracker/CVE-2026-74408
https://access.redhat.com/security/cve/CVE-2026-74408
https://ubuntu.com/security/CVE-2026-74408

Impacted products

5 products from 5 vendors

Vendors

Red Hat, Inc., Canonical Ltd., Сообщество свободного программного обеспечения, ООО «Ред Софт»

Products

Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), Linux

Versions

7 (Red Hat Enterprise Linux), 16.04 LTS (Ubuntu), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (РЕД ОС), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 10 (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (РЕД ОС), 26.04 LTS (Ubuntu), от 6.2 до 6.6.145 (Linux), от 6.7 до 6.12.97 (Linux), от 6.13 до 6.18.40 (Linux), от 6.19 до 7.1.5 (Linux), от 5.16 до 6.1.178 (Linux), от 5.11 до 5.15.212 (Linux), от 3.1 до 5.10.261 (Linux)

Product types

Operating system

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 7, Canonical Ltd. Ubuntu 16.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 9, Canonical Ltd. Ubuntu 18.04 LTS, Inc. Red Hat Enterprise Linux 8, Сообщество свободного программного обеспечения Debian GNU/Linux 10, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 10, Сообщество свободного программного обеспечения Debian GNU/Linux 13, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 26.04 LTS, Сообщество свободного программного обеспечения Linux от 6.2 до 6.6.145, Сообщество свободного программного обеспечения Linux от 6.7 до 6.12.97, Сообщество свободного программного обеспечения Linux от 6.13 до 6.18.40, Сообщество свободного программного обеспечения Linux от 6.19 до 7.1.5, Сообщество свободного программного обеспечения Linux от 5.16 до 6.1.178, Сообщество свободного программного обеспечения Linux от 5.11 до 5.15.212, Сообщество свободного программного обеспечения Linux от 3.1 до 5.10.261

Mitigations

Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0 https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25 https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379 https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481 https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54 Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/ http://repo.red-soft.ru/redos/8.0/aarch64/updates/ http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-74408 https://deb.freexian.com/extended-lts/tracker/CVE-2026-74408 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/CVE-2026-74408 Для Ubuntu: https://ubuntu.com/security/CVE-2026-74408

JSON

To clipboard

{
  "CVSS 2.0": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7 (Red Hat Enterprise Linux), 16.04 LTS (Ubuntu), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 10 (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 26.04 LTS (Ubuntu), \u043e\u0442 6.2 \u0434\u043e 6.6.145 (Linux), \u043e\u0442 6.7 \u0434\u043e 6.12.97 (Linux), \u043e\u0442 6.13 \u0434\u043e 6.18.40 (Linux), \u043e\u0442 6.19 \u0434\u043e 7.1.5 (Linux), \u043e\u0442 5.16 \u0434\u043e 6.1.178 (Linux), \u043e\u0442 5.11 \u0434\u043e 5.15.212 (Linux), \u043e\u0442 3.1 \u0434\u043e 5.10.261 (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0\nhttps://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc\nhttps://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc\nhttps://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25\nhttps://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0\nhttps://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379\nhttps://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481\nhttps://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-74408\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-74408\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/CVE-2026-74408\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-74408",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "16.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "16.10.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-16694",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-74408, GHSA-6HV7-5H9P-9JRW",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 7 , Canonical Ltd. Ubuntu 16.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 26.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.2 \u0434\u043e 6.6.145 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7 \u0434\u043e 6.12.97 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.13 \u0434\u043e 6.18.40 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19 \u0434\u043e 7.1.5 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.16 \u0434\u043e 6.1.178 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.11 \u0434\u043e 5.15.212 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 3.1 \u0434\u043e 5.10.261 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 ath_tx_edma_tasklet() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 drivers/net/wireless/ath/ath9k/xmit.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0417\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 (CWE-787)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 ath_tx_edma_tasklet() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 drivers/net/wireless/ath/ath9k/xmit.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0\nhttps://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc\nhttps://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc\nhttps://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25\nhttps://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0\nhttps://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379\nhttps://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481\nhttps://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54\nhttps://github.com/advisories/GHSA-6hv7-5h9p-9jrw\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttps://security-tracker.debian.org/tracker/CVE-2026-74408\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-74408\nhttps://access.redhat.com/security/cve/CVE-2026-74408\nhttps://ubuntu.com/security/CVE-2026-74408",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-787",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,3)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,8)"
}

CVE-2026-74408 (GCVE-0-2026-74408)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-10-16 19:05

Title

wifi: ath9k: fix OOB access from firmware tx status queue ID

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:55 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/fb11083db9d7d6fb8…
https://git.kernel.org/stable/c/734db72d55ca578a3…
https://git.kernel.org/stable/c/f5931d06b45ed4025…
https://git.kernel.org/stable/c/46ca1451f61b598f4…
https://git.kernel.org/stable/c/a9e055ac62cb3fcea…
https://git.kernel.org/stable/c/5435fd3edcb11c7cc…
https://git.kernel.org/stable/c/336d4c8cd9b164606…
https://git.kernel.org/stable/c/7ce2f118a2389e8f0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54 (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 734db72d55ca578a344dfa33e30145032c074b25 (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < f5931d06b45ed402572bfe5832fff15864ef5481 (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 46ca1451f61b598f45cb5259e066d305444d95fc (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < a9e055ac62cb3fcea262d4b687ec73eed82b3379 (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 5435fd3edcb11c7cc4002847c83e9a50b49284dc (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 336d4c8cd9b1646060ee690c881d465dfc09c6c0 (git) Affected: fce041beb03f93c7a771f0b4b6c45bb71ef90901 , < 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 (git)
Linux	Linux	Affected: 3.1 Unaffected: 0 , < 3.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:55:57.152844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:43.633Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/xmit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "734db72d55ca578a344dfa33e30145032c074b25",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "f5931d06b45ed402572bfe5832fff15864ef5481",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "46ca1451f61b598f45cb5259e066d305444d95fc",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "a9e055ac62cb3fcea262d4b687ec73eed82b3379",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "5435fd3edcb11c7cc4002847c83e9a50b49284dc",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "336d4c8cd9b1646060ee690c881d465dfc09c6c0",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            },
            {
              "lessThan": "7ce2f118a2389e8f0a64068c6fe7cc7d40639be0",
              "status": "affected",
              "version": "fce041beb03f93c7a771f0b4b6c45bb71ef90901",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/xmit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: fix OOB access from firmware tx status queue ID\n\nath_tx_edma_tasklet() accesses sc-\u003etx.txq[ts.qid] where ts.qid is a\n4-bit hardware field (0-15), but the txq array only has\nATH9K_NUM_TX_QUEUES (10) entries. A qid \u003e= 10 causes an OOB array\naccess.\n\nAdd a bounds check on ts.qid before using it as an array index."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires sending 802.11 frames over WiFi to a victim using an EDMA-capable ath9k device (routers, embedded APs, laptops); TX completion interrupts from that traffic reach ath_tx_edma_tasklet() via ath_isr/ath9k_interrupt.\nAC:L - An adjacent attacker can repeatedly induce TX completions and error/status conditions with crafted or high-volume 802.11 traffic; they control timing and load on both sides of the race, making invalid firmware qid values (10-15) reachable without conditions outside attacker influence.\nPR:N - No local account or kernel privileges are required; unauthenticated adjacent WiFi frames (probes, data, deauth/flood) cause the victim radio to transmit and process firmware TX status reports on the interrupt path.\nUI:N - No victim interaction is needed beyond the device having WiFi active, which is the normal operating state for routers, phones, and IoT APs using ath9k hardware.\nS:U - Impact is confined to kernel memory corruption and privilege escalation or denial of service on the affected host; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Out-of-bounds indexing of sc-\u003etx.txq[ts.qid] reads adjacent ath_softc/ath_tx fields as struct ath_txq (spinlocks, list heads, DMA metadata), constituting an unbounded OOB kernel memory read exploitable for information disclosure.\nI:H - The OOB txq pointer is dereferenced for spin_lock_bh, list_head manipulation, and ath_tx_process_buffer(), writing through misaligned kernel structures and enabling heap corruption and potential arbitrary code execution.\nA:H - Locking and list operations on memory interpreted as the wrong ath_txq can cause kernel oops, panic, or hang, and repeated adjacent triggering can sustain denial of service on the wireless host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:51.612Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54"
        },
        {
          "url": "https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481"
        },
        {
          "url": "https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379"
        },
        {
          "url": "https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0"
        }
      ],
      "title": "wifi: ath9k: fix OOB access from firmware tx status queue ID",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74408",
    "datePublished": "2026-08-15T05:59:16.701Z",
    "dateReserved": "2026-08-15T05:44:03.892Z",
    "dateUpdated": "2026-10-16T19:05:43.633Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-6HV7-5H9P-9JRW

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74408"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:42Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: fix OOB access from firmware tx status queue ID\n\nath_tx_edma_tasklet() accesses sc-\u003etx.txq[ts.qid] where ts.qid is a\n4-bit hardware field (0-15), but the txq array only has\nATH9K_NUM_TX_QUEUES (10) entries. A qid \u003e= 10 causes an OOB array\naccess.\n\nAdd a bounds check on ts.qid before using it as an array index.",
  "id": "GHSA-6hv7-5h9p-9jrw",
  "modified": "2026-08-17T06:33:43Z",
  "published": "2026-08-15T06:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74408"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-16694 (CVE-2026-74408)

CVE-2026-74408 (GCVE-0-2026-74408)

GHSA-6HV7-5H9P-9JRW

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour